revert(bedrock): drop the unreachable guardrails saved-credential plumbing

The Guardrails block evaluates its provider credential conditions without
values, so its Bedrock fields never render or serialize; the param could
only arrive outside the shared auth-mode rule.

Author: waleedlatif1

apps/sim/lib/guardrails/validate-hallucination.test.ts

@@ -4,18 +4,9 @@ import { providersUtilsMock, providersUtilsMockFns } from '@sim/testing/mocks/pr
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type { BillingAttributionSnapshot } from '@/lib/billing/core/attribution'
 
-const {
-  mockSearchKnowledgeAsExecutor,
-  mockResolveVertexAccessToken,
-  mockResolveBedrockCredentialSession,
-} = vi.hoisted(() => ({
+const { mockSearchKnowledgeAsExecutor, mockResolveVertexAccessToken } = vi.hoisted(() => ({
   mockSearchKnowledgeAsExecutor: vi.fn(),
   mockResolveVertexAccessToken: vi.fn(),
-  mockResolveBedrockCredentialSession: vi.fn(),
-}))
-
-vi.mock('@/lib/internal/llm/bedrock-credential', () => ({
-  resolveBedrockCredentialSession: mockResolveBedrockCredentialSession,
 }))
 
 vi.mock('@/lib/internal/llm/credentials', () => ({
@@ -232,58 +223,6 @@ describe('validateHallucination', () => {
     })
   })
 
-  describe('with a Bedrock model and a saved AWS credential', () => {
-    const bedrockInput = (registry: ResolvedSecretTraceRegistry) => ({
-      ...createInput(registry),
-      model: 'bedrock/claude',
-      providerCredentials: { bedrockCredential: 'aws-cred', bedrockRegion: 'eu-west-1' },
-    })
-
-    beforeEach(() => {
-      mockResolveBedrockCredentialSession.mockReset()
-    })
-
-    it("scores with the credential's session resolved for the acting user", async () => {
-      providersUtilsMockFns.mockGetProviderFromModel.mockReturnValue('bedrock')
-      const session = {
-        credentialId: 'aws-cred',
-        accessKeyId: 'ASIASESSIONKEY000001',
-        secretAccessKey: 'session-secret',
-        sessionToken: 'session-token',
-      }
-      mockResolveBedrockCredentialSession.mockResolvedValueOnce(session)
-
-      const result = await validateHallucination(bedrockInput(new ResolvedSecretTraceRegistry()))
-
-      expect(result.error).toBeUndefined()
-      expect(result).toMatchObject({ passed: true, score: 8 })
-      expect(mockResolveBedrockCredentialSession).toHaveBeenCalledWith(
-        expect.objectContaining({
-          credentialId: 'aws-cred',
-          actingUserId: 'user-1',
-          workflowId: 'workflow-1',
-          workspaceId: 'workspace-1',
-        })
-      )
-      expect(mockExecuteProviderRequest.mock.calls[0]?.[1]).toMatchObject({
-        bedrockSession: session,
-        bedrockRegion: 'eu-west-1',
-      })
-    })
-
-    it('fails the check instead of calling the model when the credential cannot be used', async () => {
-      providersUtilsMockFns.mockGetProviderFromModel.mockReturnValue('bedrock')
-      mockResolveBedrockCredentialSession.mockRejectedValueOnce(
-        new Error('Not authorized to use this AWS credential')
-      )
-
-      const result = await validateHallucination(bedrockInput(new ResolvedSecretTraceRegistry()))
-
-      expect(result).toMatchObject({ passed: false })
-      expect(mockExecuteProviderRequest).not.toHaveBeenCalled()
-    })
-  })
-
   /**
    * Forwarding the caller's signal means the scoring model can now be aborted. A
    * cancelled run must not be reported as a guardrail verdict — `passed: false` would

apps/sim/lib/guardrails/validate-hallucination.ts

@@ -3,15 +3,13 @@ import { getErrorMessage } from '@sim/utils/errors'
 import { isPlainRecord } from '@sim/utils/object'
 import type { BillingAttributionSnapshot } from '@/lib/billing/core/attribution'
 import { searchKnowledgeAsExecutor } from '@/lib/internal/knowledge/search'
-import { resolveBedrockCredentialSession } from '@/lib/internal/llm/bedrock-credential'
 import { resolveVertexAccessToken } from '@/lib/internal/llm/credentials'
 import type { InternalToolOperationContext } from '@/lib/internal/tool-operations/types'
 import { projectResolvedSecretModelContent } from '@/executor/utils/resolved-secret-content-projection'
 import { refuseResolvedSecretProjection } from '@/executor/utils/resolved-secret-projection-refusal'
 import type { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 import { executeProviderRequest } from '@/providers'
 import { isAbortError } from '@/providers/streaming-tool-loop-shared'
-import type { BedrockCredentialSession } from '@/providers/types'
 import { getProviderFromModel } from '@/providers/utils'
 
 const logger = createLogger('HallucinationValidator')
@@ -42,8 +40,6 @@ export interface HallucinationValidationInput {
     bedrockAccessKeyId?: string
     bedrockSecretKey?: string
     bedrockRegion?: string
-    /** A saved AWS credential ID; resolved for the acting user before the scoring call. */
-    bedrockCredential?: string
   }
   workflowId?: string
   workspaceId?: string
@@ -119,7 +115,6 @@ async function scoreHallucinationWithLLM(
   model: string,
   apiKey: string | undefined,
   providerCredentials: HallucinationValidationInput['providerCredentials'],
-  bedrockSession: BedrockCredentialSession | undefined,
   workspaceId: string | undefined,
   requestId: string,
   resolvedSecretTraceRegistry: ResolvedSecretTraceRegistry,
@@ -187,7 +182,6 @@ Evaluate the consistency and provide your score and reasoning in JSON format.`
         bedrockAccessKeyId: providerCredentials?.bedrockAccessKeyId,
         bedrockSecretKey: providerCredentials?.bedrockSecretKey,
         bedrockRegion: providerCredentials?.bedrockRegion,
-        bedrockSession,
         workspaceId,
         abortSignal,
       },
@@ -253,7 +247,6 @@ export async function validateHallucination(
     providerCredentials,
     workflowId,
     workspaceId,
-    actorUserId,
     executionContext,
     billingAttribution,
     requestId,
@@ -326,25 +319,13 @@ export async function validateHallucination(
       throw new Error('Hallucination model input provenance is unavailable')
     }
 
-    const bedrockSession =
-      getProviderFromModel(model) === 'bedrock' && providerCredentials?.bedrockCredential
-        ? await resolveBedrockCredentialSession({
-            credentialId: providerCredentials.bedrockCredential,
-            actingUserId: actorUserId,
-            workflowId,
-            workspaceId,
-            signal: abortSignal,
-          })
-        : undefined
-
     // Step 2: Use LLM to score confidence
     const { score, reasoning, cost } = await scoreHallucinationWithLLM(
       inputProjection.value,
       contextProjection.value,
       model,
       apiKey,
       providerCredentials,
-      bedrockSession,
       workspaceId,
       requestId,
       providerRegistry,

apps/sim/lib/internal/guardrails/input.ts

@@ -22,7 +22,6 @@ export const guardrailsValidationInputSchema = z.object({
   bedrockAccessKeyId: z.string().optional(),
   bedrockSecretKey: z.string().optional(),
   bedrockRegion: z.string().optional(),
-  bedrockCredential: z.string().optional(),
   workflowId: z.string().optional(),
   piiEntityTypes: z.array(z.string()).optional(),
   piiMode: z.string().optional(),

apps/sim/lib/internal/guardrails/operations.ts

@@ -239,7 +239,6 @@ async function executeValidation(
         bedrockAccessKeyId: input.bedrockAccessKeyId,
         bedrockSecretKey: input.bedrockSecretKey,
         bedrockRegion: input.bedrockRegion,
-        bedrockCredential: input.bedrockCredential,
       },
       workflowId: input.workflowId,
       workspaceId: hallucinationContext.workspaceId,

apps/sim/tools/guardrails/validate.ts

@@ -26,7 +26,6 @@ export interface GuardrailsValidateInput {
   bedrockAccessKeyId?: string
   bedrockSecretKey?: string
   bedrockRegion?: string
-  bedrockCredential?: string
   piiEntityTypes?: string[]
   piiMode?: string
   piiLanguage?: string
@@ -217,7 +216,6 @@ export const guardrailsValidateTool: InternalToolConfig<
       bedrockAccessKeyId: params.bedrockAccessKeyId,
       bedrockSecretKey: params.bedrockSecretKey,
       bedrockRegion: params.bedrockRegion,
-      bedrockCredential: params.bedrockCredential,
       piiEntityTypes: Array.isArray(params.piiEntityTypes) ? params.piiEntityTypes : undefined,
       piiMode: params.piiMode,
       piiLanguage: params.piiLanguage,